El gancho
Supply-chain malware is different from a normal dependency bug: the dangerous action can happen during installation, before the application ever starts. For @tanstack/arktype-adapter, the repo evidence that matters most is whether a project resolves to one of the malicious published versions.
Cómo funciona
The repo check looks for the npm package `@tanstack/arktype-adapter` in package manifests and lockfiles. Exact manifest declarations and lockfile-resolved versions are reported when they match 1.166.12 or 1.166.15, the affected versions listed by the TanStack and GitHub advisories.
El radio de impacto
If either malicious version was installed in a developer workstation or CI environment, credentials available to that install process should be treated as potentially exposed. A repo match should trigger package cleanup, cache/image rebuilds, and credential-impact review, but it is not proof that FixVibe observed exfiltration or host compromise.
// qué comprueba fixvibe
Qué comprueba FixVibe
FixVibe repo scans look for high-confidence security patterns and dependency risk in source context. Reports identify the affected area and recommended fix. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Defensas a prueba de balas
Upgrade @tanstack/arktype-adapter to 1.166.16 or a newer clean release, or remove it if unused. Regenerate the active lockfile from a trusted registry state, rebuild CI images, Docker layers, devcontainers, and dependency caches, then rotate install-time credentials if either malicious version was ever installed.